Skip to content

Commit 7b4b6c5

Browse files
r2c-argo[bot]0xDC0DELewisArdern
authored
Add gcp sql rules for insecure ssl_mode (#3540) (#3553)
* Add gcp sql rules for insecure ssl_mode * clean up message and references --------- Co-authored-by: Pieter De Cremer (Semgrep) <pieter@r2c.dev> Co-authored-by: Lewis <LewisArdern@live.co.uk>
1 parent 32750f0 commit 7b4b6c5

7 files changed

+670
-1
lines changed

‎terraform/gcp/security/gcp-sql-database-require-ssl.yaml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,8 @@ rules:
3939
- terraform
4040
- gcp
4141
references:
42-
- https://owasp.org/Top10/A02_2021-Cryptographic_Failures
42+
- "https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration"
43+
- "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
4344
subcategory:
4445
- vuln
4546
likelihood: LOW

‎terraform/gcp/security/gcp-sql-database-ssl-insecure-value-postgres-mysql.fixed.tf‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
2+
resource "google_sql_database_instance" "fail" {
3+
database_version = "MYSQL_8_0"
4+
name = "instance"
5+
region = "us-central1"
6+
settings {
7+
tier = "db-f1-micro"
8+
}
9+
}
10+
11+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
12+
resource "google_sql_database_instance" "success" {
13+
database_version = "MYSQL_8_0"
14+
name = "instance"
15+
region = "us-central1"
16+
ip_configuration {
17+
ipv4_enabled = true
18+
require_ssl = true
19+
}
20+
}
21+
22+
resource "google_sql_database_instance" "main" {
23+
name = "some-example-name"
24+
database_version = "POSTGRES_15"
25+
region = "europe-west3"
26+
settings {
27+
tier = "db-f1-micro"
28+
ip_configuration {
29+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
30+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
31+
}
32+
}
33+
}
34+
35+
resource "google_sql_database_instance" "main" {
36+
name = "some-example-name"
37+
database_version = "POSTGRES_15"
38+
region = "europe-west3"
39+
settings {
40+
tier = "db-f1-micro"
41+
ip_configuration {
42+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
43+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
44+
}
45+
}
46+
}
47+
48+
resource "google_sql_database_instance" "main" {
49+
name = "some-example-name"
50+
database_version = "POSTGRES_15"
51+
region = "europe-west3"
52+
settings {
53+
tier = "db-f1-micro"
54+
ip_configuration {
55+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
56+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
57+
}
58+
}
59+
}
60+
61+
resource "google_sql_database_instance" "main" {
62+
name = "some-example-name"
63+
database_version = "POSTGRES_15"
64+
region = "europe-west3"
65+
settings {
66+
tier = "db-f1-micro"
67+
ip_configuration {
68+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
69+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
70+
}
71+
}
72+
}
73+
74+
resource "google_sql_database_instance" "mysql_fail" {
75+
database_version = "MYSQL_8_0"
76+
name = "mysql-instance"
77+
region = "us-central1"
78+
settings {
79+
tier = "db-f1-micro"
80+
ip_configuration {
81+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
82+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
83+
}
84+
}
85+
}
86+
87+
resource "google_sql_database_instance" "mysql_success" {
88+
database_version = "MYSQL_8_0"
89+
name = "mysql-instance"
90+
region = "us-central1"
91+
settings {
92+
tier = "db-f1-micro"
93+
ip_configuration {
94+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
95+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
96+
}
97+
}
98+
}
99+
100+
resource "google_sql_database_instance" "sqlserver_fail" {
101+
database_version = "SQLSERVER_2019_STANDARD"
102+
name = "sqlserver-instance"
103+
region = "us-central1"
104+
settings {
105+
tier = "db-f1-micro"
106+
ip_configuration {
107+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
108+
ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
109+
}
110+
}
111+
}
112+
113+
resource "google_sql_database_instance" "sqlserver_success" {
114+
database_version = "SQLSERVER_2019_STANDARD"
115+
name = "sqlserver-instance"
116+
region = "us-central1"
117+
settings {
118+
tier = "db-f1-micro"
119+
ip_configuration {
120+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
121+
ssl_mode = "ENCRYPTED_ONLY"
122+
}
123+
}
124+
}
125+
126+
resource "google_sql_database_instance" "mysql_success_with_ssl_mode" {
127+
database_version = "MYSQL_8_0"
128+
name = "mysql-instance"
129+
region = "us-central1"
130+
settings {
131+
tier = "db-f1-micro"
132+
ip_configuration {
133+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
134+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
135+
}
136+
}
137+
}
138+

‎terraform/gcp/security/gcp-sql-database-ssl-insecure-value-postgres-mysql.tf‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,138 @@
1+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
2+
resource "google_sql_database_instance" "fail" {
3+
database_version = "MYSQL_8_0"
4+
name = "instance"
5+
region = "us-central1"
6+
settings {
7+
tier = "db-f1-micro"
8+
}
9+
}
10+
11+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
12+
resource "google_sql_database_instance" "success" {
13+
database_version = "MYSQL_8_0"
14+
name = "instance"
15+
region = "us-central1"
16+
ip_configuration {
17+
ipv4_enabled = true
18+
require_ssl = true
19+
}
20+
}
21+
22+
resource "google_sql_database_instance" "main" {
23+
name = "some-example-name"
24+
database_version = "POSTGRES_15"
25+
region = "europe-west3"
26+
settings {
27+
tier = "db-f1-micro"
28+
ip_configuration {
29+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
30+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
31+
}
32+
}
33+
}
34+
35+
resource "google_sql_database_instance" "main" {
36+
name = "some-example-name"
37+
database_version = "POSTGRES_15"
38+
region = "europe-west3"
39+
settings {
40+
tier = "db-f1-micro"
41+
ip_configuration {
42+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
43+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
44+
}
45+
}
46+
}
47+
48+
resource "google_sql_database_instance" "main" {
49+
name = "some-example-name"
50+
database_version = "POSTGRES_15"
51+
region = "europe-west3"
52+
settings {
53+
tier = "db-f1-micro"
54+
ip_configuration {
55+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
56+
ssl_mode = "ENCRYPTED_ONLY"
57+
}
58+
}
59+
}
60+
61+
resource "google_sql_database_instance" "main" {
62+
name = "some-example-name"
63+
database_version = "POSTGRES_15"
64+
region = "europe-west3"
65+
settings {
66+
tier = "db-f1-micro"
67+
ip_configuration {
68+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
69+
ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
70+
}
71+
}
72+
}
73+
74+
resource "google_sql_database_instance" "mysql_fail" {
75+
database_version = "MYSQL_8_0"
76+
name = "mysql-instance"
77+
region = "us-central1"
78+
settings {
79+
tier = "db-f1-micro"
80+
ip_configuration {
81+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
82+
ssl_mode = "ENCRYPTED_ONLY"
83+
}
84+
}
85+
}
86+
87+
resource "google_sql_database_instance" "mysql_success" {
88+
database_version = "MYSQL_8_0"
89+
name = "mysql-instance"
90+
region = "us-central1"
91+
settings {
92+
tier = "db-f1-micro"
93+
ip_configuration {
94+
# ruleid: gcp-sql-database-ssl-insecure-value-postgres-mysql
95+
ssl_mode = "ENCRYPTED_ONLY"
96+
}
97+
}
98+
}
99+
100+
resource "google_sql_database_instance" "sqlserver_fail" {
101+
database_version = "SQLSERVER_2019_STANDARD"
102+
name = "sqlserver-instance"
103+
region = "us-central1"
104+
settings {
105+
tier = "db-f1-micro"
106+
ip_configuration {
107+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
108+
ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"
109+
}
110+
}
111+
}
112+
113+
resource "google_sql_database_instance" "sqlserver_success" {
114+
database_version = "SQLSERVER_2019_STANDARD"
115+
name = "sqlserver-instance"
116+
region = "us-central1"
117+
settings {
118+
tier = "db-f1-micro"
119+
ip_configuration {
120+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
121+
ssl_mode = "ENCRYPTED_ONLY"
122+
}
123+
}
124+
}
125+
126+
resource "google_sql_database_instance" "mysql_success_with_ssl_mode" {
127+
database_version = "MYSQL_8_0"
128+
name = "mysql-instance"
129+
region = "us-central1"
130+
settings {
131+
tier = "db-f1-micro"
132+
ip_configuration {
133+
# ok: gcp-sql-database-ssl-insecure-value-postgres-mysql
134+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
135+
}
136+
}
137+
}
138+

‎terraform/gcp/security/gcp-sql-database-ssl-insecure-value-postgres-mysql.yaml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
rules:
2+
- id: gcp-sql-database-ssl-insecure-value-postgres-mysql
3+
patterns:
4+
- pattern-inside: |
5+
resource "google_sql_database_instance" "..." {
6+
...
7+
database_version = "$DB"
8+
...
9+
}
10+
- pattern-inside: |
11+
resource "google_sql_database_instance" "..." {
12+
...
13+
ip_configuration {
14+
...
15+
ssl_mode = $VALUE
16+
...
17+
}
18+
...
19+
}
20+
- pattern-not-inside: |
21+
resource "google_sql_database_instance" "..." {
22+
...
23+
ip_configuration {
24+
...
25+
ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
26+
...
27+
}
28+
...
29+
}
30+
- metavariable-regex:
31+
metavariable: $DB
32+
regex: .*(MYSQL|POSTGRES).*
33+
- focus-metavariable: $VALUE
34+
fix: |
35+
"TRUSTED_CLIENT_CERTIFICATE_REQUIRED"
36+
message: >-
37+
Ensure all Cloud SQL database instance require incoming connections to use SSL. To enable this for PostgresSQL and MySQL, use `ssl_mode="TRUSTED_CLIENT_CERTIFICATE_REQUIRED"`.
38+
metadata:
39+
owasp:
40+
- A03:2017 - Sensitive Data Exposure
41+
- A02:2021 - Cryptographic Failures
42+
cwe:
43+
- 'CWE-326: Inadequate Encryption Strength'
44+
category: security
45+
technology:
46+
- terraform
47+
- gcp
48+
references:
49+
- "https://cloud.google.com/sql/docs/postgres/admin-api/rest/v1/instances#ipconfiguration"
50+
- "https://owasp.org/Top10/A02_2021-Cryptographic_Failures"
51+
subcategory:
52+
- vuln
53+
likelihood: LOW
54+
impact: MEDIUM
55+
confidence: MEDIUM
56+
languages: [hcl]
57+
severity: WARNING
58+

0 commit comments

Comments
 (0)